---
description: Your competitors are already issuing crypto-linked cards. The crypto card issuing API they used took days to integrate, not months.
title: "Crypto Card Issuing API: A Practical Guide to How One Actually Works - UPay Blog"
image: https://blog.upay.com/wp-content/uploads/2026/07/crypto-card-issuing-API.png
---

[Skip to content](#content)

# Crypto Card Issuing API: A Practical Guide to How One Actually Works

- [![Picture of Ngozi Peace Okafor](https://secure.gravatar.com/avatar/ce61c8756bae352b59f99a5b8d3929c6032bbd7c20a78e9848bf9079c4ba9368?s=96&d=mm&r=g) Ngozi Peace Okafor](https://blog.upay.com/author/ngozi/)
- [September 29, 2026](https://blog.upay.com/2026/09/29/)
- 9:08 am
- Categories: [Business](https://blog.upay.com/category/business/)

![Image showing crypto card issuing API](https://blog.upay.com/wp-content/uploads/2026/07/crypto-card-issuing-API-1024x536.png)

Building a card programme the old way means a sponsor bank, a processor, a personalisation bureau and a compliance function, assembled one contract at a time. The figure people quote for that is eighteen months.

A card issuing API is the argument that you no longer have to. It does not make that work disappear so much as move most of it onto somebody else’s balance sheet, and what is left is worth understanding before you sign.

## Key Takeaways

- A crypto card issuing API lets a business create and manage payment cards linked to crypto balances, usually without holding its own card licence, bank sponsorship or processing stack.
- UPay Business publishes issuance of physical and virtual Visa cards through a single API, crypto payment fees of under 1 percent against the 3 to 5 percent it gives for traditional cross-border payments, and acceptance of BTC, ETH, USDT and more than 50 other assets across TRC20, ERC20 and BSC.
- UPay Business publishes about five minutes for crypto settlement and T+0 or T+1 for the fiat payout leg depending on the channel, with bank settlement at T+1. Those are different legs, not a contradiction, so ask which leg your corridor ends on.
- UPay’s own developer documentation publishes a test environment, a 60-second signature validity window per request and mandatory IP allow-listing, and lists its production base URL as not publicly disclosed.
- The compliance you inherit is real: identity verification, transaction monitoring, sanctions screening, the Travel Rule at 3,000 US dollars in the United States, and PCI DSS v4.0.1, now the only active version, whose 51 future-dated requirements became effective on 31 March 2025.
- On registrations, take what UPay itself lists: a Hong Kong money services operator licence, a Lithuanian virtual asset service provider in-principle approval, and money services business registrations in the United States and Canada.

### Get UPay Crypto Card

Experience the Best of Online Payment and Seamless Crypto Transactions.

[Sign Up](https://upay.best/register)

## What a Crypto Card Issuing API Is

A crypto card issuing API is a set of programmable endpoints that let a business create, fund, freeze and cancel payment cards tied to a customer’s crypto balance, without owning the machinery underneath.

The provider holds the relationships that are hard to get: network membership, the issuing arrangement, processing and conversion. You keep the customer, the brand and the spending rules.

The conversion step is where the crypto part lives. The card is an ordinary card on an ordinary network; what the provider adds turns a crypto balance into settlement currency at authorisation, so the merchant sees a normal transaction and the customer a crypto debit.

## How the Flow Works, Step by Step

![How a Crypto Card Issuing API Actually Works.](https://blog.upay.com/wp-content/uploads/2026/07/image-156.png)

**Onboarding and identity checks.** Your application collects the customer’s details and submits them through the provider’s verification endpoints. The result comes back asynchronously, so build for a pending state rather than a yes or no.

**Funding the balance.** The customer moves crypto into the account the card draws on. On UPay that is a recharge from the UPay wallet rather than a direct debit, so the balance is something your customer keeps topped up.

**Issuance and provisioning.** A virtual card issues quickly. A physical one has to be produced and shipped, which is why UPay’s card endpoints include activation and logistics tracking alongside registration.

**Authorisation.** When the customer pays, the network sends an authorisation request, the provider checks the balance and your spending rules, converts, and approves or declines. Anything you want to control has to be set in advance.

**Settlement and reconciliation.** Cleared transactions settle to the merchant through the network while your side reconciles against webhooks. The webhook feed is the record and the dashboard is the summary.

Our note on [how USDT payments work](https://blog.upay.com/how-usdt-payments-work/) covers what a chain confirmation actually tells you, which is the input to that reconciliation.

## What UPay’s API Documentation Actually Publishes

Here is what UPay’s own developer documentation and business pages state.

| **What a buyer asks** | **What UPay’s own material publishes** | **Where it says it** |
| --- | --- | --- |
| Which cards can I issue? | Physical and virtual Visa cards through a single API | UPay Business site |
| Is there a sandbox? | A test environment is published; staging is listed as unavailable and the production base URL is not publicly disclosed | UPay API reference |
| How is a request authenticated? | Each request is signed, and a signature is valid for 60 seconds before it has to be regenerated | UPay API reference |
| Are there network restrictions? | Calling IP addresses must be allow-listed, and responses come only from designated addresses | UPay API reference |
| What can I do to a card? | Register, activate, recharge, lock and unlock, cancel, query bills, set a trade password, track logistics, confirm 3-D Secure, authorise a spend amount | UPay API reference |
| What else does the API cover? | Merchant, Account, CustomerGroup, Customer, Address, Card, Wallet, Acquirer, Outlay, IFrame, file upload, region list, code list and webhook groups | UPay API reference |
| Is the documentation in English? | The primary reference is in Simplified Chinese; a full English mirror is published at upay-api-en.readme.io (https://upay-api-en.readme.io/) | UPay API reference, both editions |
| How do I know something happened? | Webhook notifications for card, wallet, acquiring and payout events | UPay API reference |
| What does it cost to process? | Under 1 percent on crypto payments, against 3 to 5 percent quoted for traditional cross-border | UPay Business site |
| How fast does money settle? | About 5 minutes on chain (“\~ 5 minutes”); fiat payout T+0 or T+1 depending on the channel; bank settlement T+1 | UPay Business site and its crypto payment page |

Both are worth reading before you scope the work: the allow-list constrains where your code runs, and a 60-second signature window constrains how it retries.

UPay Business publishes about five minutes for crypto settlement, giving “\~ 5 minutes” against 1 to 5 business days for traditional rails, while its crypto payment page says on-chain settlement “can be completed in real time, while fiat settlement is typically T+0 or T+1, depending on the payout channel”, with bank settlement listed as T+1.

The quick figure is the on-chain leg and T+0 or T+1 is the fiat payout leg, so ask which leg your corridor actually ends on. UPay also publishes the only ROI figure in this category: a saving of 20,000 to 50,000 US dollars per million processed against traditional banking rails.

## The Compliance You Inherit

The technology works in a sprint. The compliance file takes a quarter, and it sets your launch date.

**Identity verification.** Card issuance is a regulated activity in every market that matters for a card programme, so every cardholder is verified before a card exists. UPay publishes submit, query and progress endpoints for it, so your product has to show a state between applied and approved.

Our explainer on [know-your-customer compliance in crypto](https://blog.upay.com/kyc-compliance-in-the-crypto-sector/) sets out what the checks do.

**Transaction monitoring and sanctions.** Screening runs against names and, for the crypto leg, against wallet addresses. The US Treasury’s Office of Foreign Assets Control has listed virtual currency addresses on its sanctions list since 2018, so an address is a screenable identifier in the same way a name is.

UPay names its infrastructure partners, which is more than most providers do: identity verification with Sumsub, which [UPay announced in May 2024](https://blog.upay.com/upay-technology-ltd-announces-strategic-partnership-with-sumsub/), stablecoin settlement with StraitsX, and cloud infrastructure with Tencent Cloud. All three are listed on UPay Business under “Built on Trusted Global Partnerships”. Named partners are checkable; “enterprise-grade infrastructure” is not.

**The Travel Rule.** In the United States, [31 CFR 1010.410(f)](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-D/section-1010.410) requires originator and beneficiary information to travel with transmittals of 3,000 US dollars or more. It predates crypto and applies to it.

**PCI DSS.** Card data security runs on the Payment Card Industry Data Security Standard. The Payment Card Industry Security Standards Council retired v4.0 on 31 December 2024, so v4.0.1 is now the only active version.

Of the 64 requirements v4.x introduced, [51 were future-dated and became effective on 31 March 2025](https://blog.pcisecuritystandards.org/now-is-the-time-for-organizations-to-adopt-the-future-dated-requirements-of-pci-dss-v4-x), so an assessment today is against the full set rather than the transitional one.

Using a provider’s hosted card fields narrows your scope. It does not remove it, and the question your auditor will ask is which fields your own code ever touches.

**Licensing.** Ask for the list and check it against the official registers rather than the marketing page. UPay lists a money services operator licence in Hong Kong, a virtual asset service provider in-principle approval in Lithuania, and money services business registrations in the United States and Canada.

UPay has published identifiers for those two: 31000257909666 for the US registration and M24993747 for the Canadian one. Search them yourself on FinCEN’s MSB Registrant Search and FINTRAC’s MSB registry, and if either does not return the entity you are contracting with, ask why before you go further.

UPay’s own two pages are not aligned on this. Its homepage lists the four as held; its About page still carries them on a “Goals and Plans” timeline as licences to obtain, dated Q3 2023 and Q1 2024, alongside a trust licence the homepage does not list.

That is the ordinary state of vendor marketing, and the reason the register rather than the page is the answer.

![Features to Look for in a Crypto Card Issuing API. ](https://blog.upay.com/wp-content/uploads/2026/07/image-157.png)

## Challenges in Using Crypto Card Issuing APIs

**The rules differ by market and by nationality.** A single API does not give you a single product. Sanctions lists, network rules and the provider’s own country list all cut into who you can serve.

**Conversion risk does not disappear, it moves.** Converting at authorisation concentrates the customer’s exposure in the seconds around each purchase. On a volatile funding asset, a decline on a balance that looked sufficient an hour earlier is a support ticket, not a bug.

**You still build the boring half.** The API issues and controls cards. Statements, dispute intake, the 3-D Secure challenge flow, the top-up reminder and the tax export are yours. Teams scope the endpoints and forget the product around them.

**Your customers need teaching.** A card funded from a wallet declines when the balance is short, with no overdraft and no automatic top-up. Say so in the onboarding flow rather than in the terms.

**You inherit the provider’s stability.** A card programme is not a dependency you can swap over a weekend. Ask what happens to live cards if the provider changes its issuing partner.

## What to Check Before You Sign

**Which markets, by what test.** Card eligibility is set by nationality rather than residence, and it differs by card. UPay’s Premier card refuses applications from a long list of countries and territories, most of them uninhabited or disputed.

Its Platinum card refuses applications from a much shorter list, but that list includes the United States, China, India, Indonesia, Pakistan, Vietnam, Turkey, Saudi Arabia and Israel, among others. The short list is the one that ends deals, and both cards separately prohibit sanctioned nationalities outright.

UPay revises the list and says it is based on Visa and major global regulatory risk and sanctions lists, so get the current version from its Help Center.

**Who is the issuer.** UPay’s cards are issued by partner institutions rather than by UPay itself, and that entity is the one whose rules bind your programme.

UPay has named one: JC Credit Limited, for its Hong Kong credit card, under terms that reference Mastercard. Its current Premier and Platinum cards and its Business API issuance run on Visa. Ask which entity issues yours.

**What rate applies.** Ask what rate is struck at authorisation, what spread is taken, and who carries the difference between authorisation and settlement.

**How you get out.** Ask what happens to your cardholders if you leave, who owns the tokenised credentials, and what notice applies. The answer is rarely in the documentation.

Weighing providers rather than mechanics? Our guide to [crypto card issuing platforms for startups](https://blog.upay.com/crypto-card-issuing-platforms-for-startups/) compares them, and [B2B crypto payment infrastructure](https://blog.upay.com/b2b-crypto-payment-infrastructure/) covers the settlement side.

## What Actually Takes the Time

A realistic first deployment runs three to four months, and very little of it is engineering: the engineering is weeks, the compliance file is the quarter. Both are working estimates rather than published figures.

Know-your-business verification on an entity with layered ownership is the step that overruns. Have incorporation documents, an ownership chart and director identification ready.

After that it is decisions rather than code: which spending controls you expose, what support does when a card declines at a fuel pump on a pre-authorisation hold, and how a customer tops up a balance that has run dry.

The integration itself is the short part, and the part our [payment gateway API integration guide](https://blog.upay.com/crypto-payment-gateway-api-integration/) walks through.

## FAQs

### Is integrating a crypto card issuing API difficult?

The integration is not the hard part. Documentation, a test environment and webhooks make the engineering a matter of weeks. Verifying your own company, the compliance sign-off and the commercial terms set the date.

### Do I need my own licence to issue cards through an API?

Usually not: the provider and its issuing partner hold the licences and you operate as a programme manager on their permissions. That is a commercial position rather than a legal opinion, so confirm it for every market you serve.

### How does a crypto card handle price movement between purchase and settlement?

The provider converts at authorisation, so the balance is debited against a rate struck at that moment. The gap between authorisation and settlement is carried somewhere, and the contract says where.

### What is the difference between card issuing and a payment gateway?

A gateway lets you accept money from customers. Issuing gives customers a card to spend with. Similar plumbing, opposite problems, and plenty of businesses want both.

### Can I issue cards to customers anywhere?

No. A card programme carries a list of countries and nationalities it cannot serve, driven by sanctions and network rules. Get the current list before you scope a market.

### Get UPay Crypto Card

Experience the Best of Online Payment and Seamless Crypto Transactions.

[Sign Up](https://upay.best/register)

![](https://blog.upay.com/wp-content/uploads/2024/05/ladyprowess.jpg)

[Ngozi Peace Okafor](https://blog.upay.com/author/ngozi/)

With years of experience in technical and crypto writing, I am a highly skilled writer who enjoys breaking down complex topics into easy-to-understand pieces. My expertise lies in the technology, open-source, blockchain, and cryptocurrency industry, where I strive to deliver engaging and informative content that educates and empowers readers.

[Twitter](https://twitter.com/ladyprowess) [Instagram](https://www.instagram.com/ladyprowess/) [Linkedin](https://www.linkedin.com/in/peace-ngozi-okafor) [User email](mailto:Okaforpeacee@gmail.com)

**Disclaimer:** This article is intended solely for informational purposes and should not be considered trading or investment advice. Nothing herein should be construed as financial, legal, or tax advice. Trading or investing in cryptocurrencies carries a considerable risk of financial loss. Always conduct due diligence before making any trading or investment decisions.

[![](https://blog.upay.com/wp-content/uploads/2024/02/telegram-cloud-document-4-5920287456015424461-1024x1024.jpg)](https://upay.best/partner)

[![](https://blog.upay.com/wp-content/uploads/2024/02/telegram-cloud-document-4-6005840253909211764-1024x1024.jpg)](https://upay.best/)

[![](https://blog.upay.com/wp-content/uploads/2024/02/telegram-cloud-document-4-5920287456015424433-1024x1024.jpg)](https://twitter.com/UPayOfficial_EN)

[![](https://blog.upay.com/wp-content/uploads/2024/02/telegram-cloud-document-4-5931307908305264107-1024x1024.jpg)](https://t.me/UPayOfficial)

## Subscribe to our Newsletter

## Join our community and stay up-to-date with the latest news, updates, and exclusive offers by subscribing to our newsletter. Enter your email address below to receive our monthly newsletter directly to your inbox.

Subscribe Now

![pop up image](https://blog.upay.com/wp-content/uploads/2024/05/Updating-1.png)

## Experience the Best of Online Payment with Crypto

## UPay offers mainstream-friendly access to crypto. Easily buy, swap, make payouts, and manage funds using our crypto card. No cross-border fees.

[Join Now](https://upay.best/register)

```json
{"@context":"https://schema.org","@graph":[{"@type":["Person","Organization"],"@id":"https://blog.upay.com/#person","name":"UPay Blog","logo":{"@type":"ImageObject","@id":"https://blog.upay.com/#logo","url":"https://blog.upay.com/wp-content/uploads/2024/02/imgi_1_upay-logo-1024x292-1.webp","contentUrl":"https://blog.upay.com/wp-content/uploads/2024/02/imgi_1_upay-logo-1024x292-1.webp","caption":"UPay Blog","inLanguage":"en-US","width":"1024","height":"292"},"image":{"@type":"ImageObject","@id":"https://blog.upay.com/#logo","url":"https://blog.upay.com/wp-content/uploads/2024/02/imgi_1_upay-logo-1024x292-1.webp","contentUrl":"https://blog.upay.com/wp-content/uploads/2024/02/imgi_1_upay-logo-1024x292-1.webp","caption":"UPay Blog","inLanguage":"en-US","width":"1024","height":"292"}},{"@type":"WebSite","@id":"https://blog.upay.com/#website","url":"https://blog.upay.com","name":"UPay Blog","publisher":{"@id":"https://blog.upay.com/#person"},"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://blog.upay.com/wp-content/uploads/2026/07/crypto-card-issuing-API.png","url":"https://blog.upay.com/wp-content/uploads/2026/07/crypto-card-issuing-API.png","width":"1200","height":"628","caption":"Image showing crypto card issuing API","inLanguage":"en-US"},{"@type":"BreadcrumbList","@id":"https://blog.upay.com/crypto-card-issuing-api/#breadcrumb","itemListElement":[{"@type":"ListItem","position":"1","item":{"@id":"https://blog.upay.com","name":"Home"}},{"@type":"ListItem","position":"2","item":{"@id":"https://blog.upay.com/crypto-card-issuing-api/","name":"Crypto Card Issuing API: A Practical Guide to How One Actually Works"}}]},{"@type":"WebPage","@id":"https://blog.upay.com/crypto-card-issuing-api/#webpage","url":"https://blog.upay.com/crypto-card-issuing-api/","name":"Crypto Card Issuing API: A Practical Guide to How One Actually Works - UPay Blog","datePublished":"2026-09-29T09:08:59+00:00","dateModified":"2026-09-29T09:09:18+00:00","isPartOf":{"@id":"https://blog.upay.com/#website"},"primaryImageOfPage":{"@id":"https://blog.upay.com/wp-content/uploads/2026/07/crypto-card-issuing-API.png"},"inLanguage":"en-US","breadcrumb":{"@id":"https://blog.upay.com/crypto-card-issuing-api/#breadcrumb"}},{"@type":"Person","@id":"https://blog.upay.com/author/ngozi/","name":"Ngozi Peace Okafor","url":"https://blog.upay.com/author/ngozi/","image":{"@type":"ImageObject","@id":"https://secure.gravatar.com/avatar/ce61c8756bae352b59f99a5b8d3929c6032bbd7c20a78e9848bf9079c4ba9368?s=96&d=mm&r=g","url":"https://secure.gravatar.com/avatar/ce61c8756bae352b59f99a5b8d3929c6032bbd7c20a78e9848bf9079c4ba9368?s=96&d=mm&r=g","caption":"Ngozi Peace Okafor","inLanguage":"en-US"},"sameAs":["https://beacons.ai/ladyprowess","https://twitter.com/ladyprowess","https://www.linkedin.com/in/peace-ngozi-okafor","https://www.instagram.com/ladyprowess/"]},{"headline":"Crypto Payment API Documentation: What It Is, How It Works, and How to Use It","description":"Understand how crypto payment APIs work from the moment a customer clicks pay to final settlement, and how to choose the right provider for your platform.","keywords":"Crypto Payment API Documentation","@type":"Article","author":{"@id":"https://blog.upay.com/author/ngozi/","name":"Ngozi Peace Okafor"},"datePublished":"2026-09-29T09:08:59+00:00","dateModified":"2026-09-29T09:09:18+00:00","image":{"@id":"https://blog.upay.com/wp-content/uploads/2026/07/crypto-card-issuing-API.png"},"name":"Crypto Payment API Documentation: What It Is, How It Works, and How to Use It","@id":"https://blog.upay.com/crypto-card-issuing-api/#schema-5742891","isPartOf":{"@id":"https://blog.upay.com/crypto-card-issuing-api/#webpage"},"publisher":{"@id":"https://blog.upay.com/#person"},"inLanguage":"en-US","mainEntityOfPage":{"@id":"https://blog.upay.com/crypto-card-issuing-api/#webpage"}}]}
```